409856 - Add 'and has been blocked based on your security preferences' to phishing error page, like on malware error page

Status: VERIFIED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[AndrewM]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b3pre) Gecko/2007122105 Minefield/3.0b3pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b3pre) Gecko/2007122105 Minefield/3.0b3pre

I think it would be good to add the text 'and has been blocked based on your security preferences' (after 'financial information') to the phishing error page, like it is on the malware error page.

Reproducible: Always

Comment 1

[AndrewM]

Attachment: Screenshot comparison of attack and phishing error pages

Comment 2

[Johnathan Nightingale [:johnath]]

Doing a straight append of the text would get us:

> The web site at www.mozilla.com has been reported as a web forgery designed to
> trick users into sharing personal or financial information and has been blocked
> based on your security preferences.

That's pretty wordy, and the middle section isn't strictly necessary, since it's mostly restated below.  Might be able to just go with the direct malware equivalent:

> The web site at www.mozilla.com has been reported a web forgery and has been blocked based on your security preferences.

Comment 3

[AndrewM]

(In reply to comment #2)
> Doing a straight append of the text would get us:
> 
> > The web site at www.mozilla.com has been reported as a web forgery designed to
> > trick users into sharing personal or financial information and has been blocked
> > based on your security preferences.
> 
> That's pretty wordy, and the middle section isn't strictly necessary, since
> it's mostly restated below.  Might be able to just go with the direct malware
> equivalent:
> 
> > The web site at www.mozilla.com has been reported a web forgery and has been blocked based on your security preferences.

Now that I think about it, that sounds like a better alternative. I like the 'designed to trick users into sharing personal or financial information' text though; maybe it could be merged with the text below so that it looks something like this:


'Web forgeries are used in scams known as phishing attacks, in which fraudulent emails and web pages are designed to imitate sources you may trust and trick you into sharing personal or financial information.

Entering any such information on this page may result in identity theft or other fraud.

You can find out more about how Minefield protects you from phishing attacks.'


This seems clearer and in a more logical order to me.

Comment 4

[AndrewM]

Any comments on my new suggested wording? Although perhaps it's a bit late for this now for Fx 3, the string freeze is tonight I think?

Comment 5

[AndrewM]

Resolving as FIXED now that the text has changed in another bug (can't remember the bug number); although I have filed bug 426067 for adding the words 'in scams known as phishing attacks.' to the new text so that some reference to 'phishing' is made.